<!DOCTYPE html>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
<title>Kerberos and LDAP</title>
<link rel="stylesheet" type="text/css" href="../C.css">
<script type="text/javascript" src="../jquery.js"></script><script type="text/javascript" src="../jquery.syntax.js"></script><script type="text/javascript" src="../yelp.js"></script>
</head>
<body id="home">
<!--<script src="https://ssl.google-analytics.com/urchin.js" type="text/javascript"></script><script type="text/javascript">
        _uacct = "UA-1018242-8";
        urchinTracker();
      </script><script>
      function englishPageVersion() {
        var href = window.location.href;
        if (href.slice(-1) == "/") {
                window.location = "index.html.en";
        } else {
                window.location = href.replace(/\.html.*/, ".html.en");
        }
         return false;
      }
      function browserPreferredLanguage() {
        var href = window.location.href;
        if (href.slice(-1) == "/") {
                window.location = href;
        } else {
                window.location = href.replace(/\.html.*/, ".html");
        }
        return false;
      }
      </script>--><div id="container">
<div id="container-inner">
<div id="mothership"><ul>
<li><a href="https://partners.ubuntu.com">Partners</a></li>
<li><a href="https://www.ubuntu.com/support/community-support">Support</a></li>
<li><a href="https://community.ubuntu.com">Community</a></li>
<li><a href="https://www.ubuntu.com">Ubuntu.com</a></li>
</ul></div>
<div id="header">
<h1 id="ubuntu-header"><a href="https://help.ubuntu.com/">Ubuntu Documentation</a></h1>
<ul id="main-menu">
<li><a class="main-menu-item current" href="https://help.ubuntu.com/">Official Documentation</a></li>
<li><a href="https://help.ubuntu.com/community/CommunityHelpWiki">Community Help Wiki</a></li>
<li><a href="https://community.ubuntu.com/t/contribute/26">Contribute</a></li>
</ul>
</div>
<div id="menu-search"><div id="search-box">
<noscript><form action="https://www.google.com/cse" id="cse-search-box"><div>
<input type="hidden" name="cx" value="003883529982892832976:e2vwumte3fq"><input type="hidden" name="ie" value="UTF-8"><input type="text" name="q" size="21"><input type="submit" name="sa" value="Search">
</div></form></noscript><!--
<script>
                document.write('<form action="https://help.ubuntu.com/search.html" id="cse-search-box">');
                document.write('  <div>');
                document.write('    <input type="hidden" name="cof" value="FORID:9">');
                document.write('    <input type="hidden" name="cx" value="003883529982892832976:e2vwumte3fq">');
                document.write('    <input type="hidden" name="ie" value="UTF-8">');
                document.write('    <input type="text" name="q" size="21">');
                document.write('    <input type="submit" name="sa" value="Search">');
                document.write('  </div>');
                document.write('</form>');
              </script>-->
</div></div>
<div class="trails"><div class="trail">
<a href="https://help.ubuntu.com/18.04" class="trail">Ubuntu 18.04</a> » <a class="trail" href="../index.html" title="Ubuntu Server Guide">Ubuntu Server Guide</a> » <a class="trail" href="network-authentication.html" title="Network Authentication">Network Authentication</a> » </div></div>
<div id="cwt-content" class="clearfix content-area"><div id="page">
<div id="content">
<div class="links nextlinks">
<a class="nextlinks-prev" href="kerberos.html" title="Kerberos">Previous</a><a class="nextlinks-next" href="sssd-ad.html" title="SSSD and Active Directory">Next</a>
</div>
<div class="hgroup"><h1 class="title">Kerberos and LDAP</h1></div>
<div class="region">
<div class="contents">
<p class="para">
    Most people will not use Kerberos by itself; once an user is authenticated
    (Kerberos), we need to figure out what this user can do (authorization).
    And that would be the job of programs such as
    <span class="app application">LDAP</span>.
    </p>
<p class="para">
    Replicating a Kerberos principal database between two servers can be complicated, and adds an additional user
    database to your network.  Fortunately, MIT Kerberos can be configured to use an <span class="app application">LDAP</span>
    directory as a principal database.  This section covers configuring a primary and secondary kerberos server to use
    <span class="app application">OpenLDAP</span> for the principal database.
    </p>
<div class="note" title="Note"><div class="inner"><div class="region"><div class="contents">
       <p class="para">
       The examples presented here assume 
       <span class="app application">MIT Kerberos</span> and 
       <span class="app application">OpenLDAP</span>.
       </p>
    </div></div></div></div>
</div>
<div class="links sectionlinks" role="navigation"><ul>
<li class="links"><a class="xref" href="kerberos-ldap.html#kerberos-ldap-openldap" title="Configuring OpenLDAP">Configuring OpenLDAP</a></li>
<li class="links"><a class="xref" href="kerberos-ldap.html#kerberos-ldap-primary-kdc" title="Primary KDC Configuration">Primary KDC Configuration</a></li>
<li class="links"><a class="xref" href="kerberos-ldap.html#kerberos-ldap-secondary-kdc" title="Secondary KDC Configuration">Secondary KDC Configuration</a></li>
<li class="links"><a class="xref" href="kerberos-ldap.html#kerberos-ldap-resources" title="Resources">Resources</a></li>
</ul></div>
<div class="sect2 sect" id="kerberos-ldap-openldap"><div class="inner">
<div class="hgroup"><h2 class="title">Configuring OpenLDAP</h2></div>
<div class="region"><div class="contents">
<p class="para">
      First, the necessary <span class="em emphasis">schema</span> needs to be loaded on an <span class="app application">OpenLDAP</span> server that has
      network connectivity to the Primary and Secondary KDCs.  The rest of this section assumes that you also have LDAP replication
      configured between at least two servers.  For information on setting up OpenLDAP see <a class="xref" href="openldap-server.html" title="OpenLDAP Server">OpenLDAP Server</a>.
      </p>
<p class="para">
      It is also required to configure OpenLDAP for TLS and SSL connections, so that traffic between the KDC and LDAP server is encrypted.
      See <a class="xref" href="openldap-server.html#openldap-tls" title="TLS">TLS</a> for details.
      </p>
<div class="note" title="Note"><div class="inner"><div class="region"><div class="contents">
         <p class="para">
         <span class="file filename">cn=admin,cn=config</span> is a user we created with 
rights to edit the ldap database. Many times it is the RootDN. Change its 
value to reflect your setup.
         </p>
      </div></div></div></div>
<div class="list itemizedlist"><ul class="list itemizedlist">
<li class="list itemizedlist">
          <p class="para">
          To load the schema into LDAP, on the LDAP server install the <span class="app application">krb5-kdc-ldap</span> package.
          From a terminal enter:
          </p>

<div class="screen"><pre class="contents "><span class="cmd command">sudo apt install krb5-kdc-ldap</span>
</pre></div>

        </li>
<li class="list itemizedlist">
          <p class="para">
          Next, extract the <span class="file filename">kerberos.schema.gz</span> file:
          </p>

<div class="screen"><pre class="contents "><span class="cmd command">sudo gzip -d /usr/share/doc/krb5-kdc-ldap/kerberos.schema.gz</span>
<span class="cmd command">sudo cp /usr/share/doc/krb5-kdc-ldap/kerberos.schema /etc/ldap/schema/</span>
</pre></div>

        </li>
<li class="list itemizedlist">

           <p class="para">
           The <span class="em emphasis">kerberos</span> schema needs to be added to the <span class="em emphasis">cn=config</span> tree.
           The procedure to add a new schema to <span class="app application">slapd</span> is also detailed in 
           <a class="xref" href="openldap-server.html#openldap-configuration" title="Modifying the slapd Configuration Database">Modifying the slapd Configuration Database</a>.
           </p>

           <div class="steps"><div class="inner"><ol class="steps">
<li class="steps">
                <p class="para">                  
                First, create a configuration file named <span class="file filename">schema_convert.conf</span>, or a similar 
                descriptive name, containing the following lines:
                </p>

<div class="code"><pre class="contents ">include /etc/ldap/schema/core.schema
include /etc/ldap/schema/collective.schema
include /etc/ldap/schema/corba.schema
include /etc/ldap/schema/cosine.schema
include /etc/ldap/schema/duaconf.schema
include /etc/ldap/schema/dyngroup.schema
include /etc/ldap/schema/inetorgperson.schema
include /etc/ldap/schema/java.schema
include /etc/ldap/schema/misc.schema
include /etc/ldap/schema/nis.schema
include /etc/ldap/schema/openldap.schema
include /etc/ldap/schema/ppolicy.schema
include /etc/ldap/schema/kerberos.schema
</pre></div>


                </li>
<li class="steps">

                  <p class="para">
                   Create a temporary directory to hold the LDIF files:
                  </p>
<div class="screen"><pre class="contents "><span class="cmd command">mkdir /tmp/ldif_output</span>
</pre></div>

                </li>
<li class="steps">

                  <p class="para">
                  Now use <span class="app application">slapcat</span> to convert the schema files: 
                  </p>

<div class="screen"><pre class="contents "><span class="cmd command">slapcat -f schema_convert.conf -F /tmp/ldif_output -n0 -s \
"cn={12}kerberos,cn=schema,cn=config" &gt; /tmp/cn=kerberos.ldif</span>
</pre></div>

                  <p class="para">
                  Change the above file and path names to match your own if they are different.
                  </p>
                
                </li>
<li class="steps">

                  <p class="para">
                  Edit the generated <span class="file filename">/tmp/cn\=kerberos.ldif</span> file, changing the following attributes: 
                  </p>

<div class="code"><pre class="contents ">dn: cn=kerberos,cn=schema,cn=config
...
cn: kerberos
</pre></div>

                  <p class="para">
                  And remove the following lines from the end of the file:
                  </p>

<div class="code"><pre class="contents ">structuralObjectClass: olcSchemaConfig
entryUUID: 18ccd010-746b-102d-9fbe-3760cca765dc
creatorsName: cn=config
createTimestamp: 20090111203515Z
entryCSN: 20090111203515.326445Z#000000#000#000000
modifiersName: cn=config
modifyTimestamp: 20090111203515Z
</pre></div>

                    <p class="para">
                    The attribute values will vary, just be sure the attributes are removed. 
                    </p>

                </li>
<li class="steps">

                  <p class="para">
                  Load the new schema with <span class="app application">ldapadd</span>:
                  </p>

<div class="screen"><pre class="contents "><span class="cmd command">sudo ldapadd -Q -Y EXTERNAL -H ldapi:/// -f /tmp/cn\=kerberos.ldif</span>
</pre></div>

                </li>
<li class="steps">
        
                  <p class="para">
                  Add an index for the <span class="em emphasis">krb5principalname</span> attribute:
                  </p>

<div class="screen"><pre class="contents "><span class="cmd command">sudo ldapmodify -Q -Y EXTERNAL -H ldapi:///</span>
<span class="output computeroutput">
<span class="input userinput">dn: olcDatabase={1}mdb,cn=config
add: olcDbIndex
olcDbIndex: krbPrincipalName eq,pres,sub</span>

modifying entry "olcDatabase={1}mdb,cn=config"</span>
</pre></div>
      
                </li>
<li class="steps">
        
                  <p class="para">
                  Finally, update the Access Control Lists (ACL):
                  </p>

<div class="screen"><pre class="contents "><span class="cmd command">sudo ldapmodify -Q -Y EXTERNAL -H ldapi:///</span>
<span class="output computeroutput">
<span class="input userinput">dn: olcDatabase={1}mdb,cn=config
replace: olcAccess
olcAccess: to attrs=userPassword,shadowLastChange,krbPrincipalKey by
 dn="cn=admin,dc=example,dc=com" write by anonymous auth by self write by * none
-
add: olcAccess
olcAccess: to dn.base="" by * read
-
add: olcAccess
olcAccess: to * by dn="cn=admin,dc=example,dc=com" write by * read</span>

modifying entry "olcDatabase={1}mdb,cn=config"
</span>
</pre></div>
      
                </li>
</ol></div></div>    
        </li>
</ul></div>
<p class="para">
      That's it, your LDAP directory is now ready to serve as a Kerberos principal database.
      </p>
</div></div>
</div></div>
<div class="sect2 sect" id="kerberos-ldap-primary-kdc"><div class="inner">
<div class="hgroup"><h2 class="title">Primary KDC Configuration</h2></div>
<div class="region"><div class="contents">
<p class="para">
      With <span class="app application">OpenLDAP</span> configured it is time to configure the KDC.
      </p>
<div class="list itemizedlist"><ul class="list itemizedlist">
<li class="list itemizedlist">
          <p class="para">
          First, install the necessary packages, from a terminal enter:
          </p>

<div class="screen"><pre class="contents "><span class="cmd command">sudo apt install krb5-kdc krb5-admin-server krb5-kdc-ldap</span>
</pre></div>

        </li>
<li class="list itemizedlist">

          <p class="para">
          Now edit <span class="file filename">/etc/krb5.conf</span> adding the following options to under the appropriate sections:
          </p>

<div class="code"><pre class="contents ">[libdefaults]
        default_realm = EXAMPLE.COM

...

[realms]
        EXAMPLE.COM = {
                kdc = kdc01.example.com
                kdc = kdc02.example.com
                admin_server = kdc01.example.com
                admin_server = kdc02.example.com
                default_domain = example.com
                database_module = openldap_ldapconf
        }

...

[domain_realm]
        .example.com = EXAMPLE.COM


...

[dbdefaults]
        ldap_kerberos_container_dn = cn=krbContainer,dc=example,dc=com

[dbmodules]
        openldap_ldapconf = {
                db_library = kldap
                ldap_kdc_dn = "cn=admin,dc=example,dc=com"

                # this object needs to have read rights on
                # the realm container, principal container and realm sub-trees
                ldap_kadmind_dn = "cn=admin,dc=example,dc=com"

                # this object needs to have read and write rights on
                # the realm container, principal container and realm sub-trees
                ldap_service_password_file = /etc/krb5kdc/service.keyfile
                ldap_servers = ldaps://ldap01.example.com ldaps://ldap02.example.com
                ldap_conns_per_server = 5
        }
</pre></div>

          <div class="note" title="Note"><div class="inner"><div class="region"><div class="contents">
            <p class="para">
            Change <span class="em emphasis">example.com</span>, <span class="em emphasis">dc=example,dc=com</span>, <span class="em emphasis">cn=admin,dc=example,dc=com</span>,
            and <span class="em emphasis">ldap01.example.com</span> to the appropriate domain, LDAP object, and LDAP server for your network.
            </p>
          </div></div></div></div>

        </li>
<li class="list itemizedlist">
        
          <p class="para">
          Next, use the <span class="app application">kdb5_ldap_util</span> utility to create the realm:
          </p>

<div class="screen"><pre class="contents "><span class="cmd command">sudo kdb5_ldap_util -D  cn=admin,dc=example,dc=com create -subtrees \
dc=example,dc=com -r EXAMPLE.COM -s -H ldap://ldap01.example.com</span>
</pre></div>
      
        </li>
<li class="list itemizedlist">
        
          <p class="para">
          Create a stash of the password used to bind to the LDAP server.  This password is used by the <span class="em emphasis">ldap_kdc_dn</span> and        
          <span class="em emphasis">ldap_kadmin_dn</span> options in <span class="file filename">/etc/krb5.conf</span>:
          </p>

<div class="screen"><pre class="contents "><span class="cmd command">sudo kdb5_ldap_util -D  cn=admin,dc=example,dc=com stashsrvpw -f \
/etc/krb5kdc/service.keyfile cn=admin,dc=example,dc=com</span>
</pre></div>
      
        </li>
<li class="list itemizedlist">
        
          <p class="para">
          Copy the CA certificate from the LDAP server:
          </p>

<div class="screen"><pre class="contents "><span class="cmd command">scp ldap01:/etc/ssl/certs/cacert.pem .</span>
<span class="cmd command">sudo cp cacert.pem /etc/ssl/certs</span>
</pre></div>

          <p class="para"> 
          And edit <span class="file filename">/etc/ldap/ldap.conf</span> to use the certificate:
          </p>

<div class="code"><pre class="contents ">TLS_CACERT /etc/ssl/certs/cacert.pem
</pre></div>

          <div class="note" title="Note"><div class="inner"><div class="region"><div class="contents">
            <p class="para">
            The certificate will also need to be copied to the Secondary KDC, to allow the connection to the LDAP servers using
            LDAPS.
            </p>
          </div></div></div></div>
      
        </li>
<li class="list itemizedlist">

          <p class="para"> 
          Start the Kerberos KDC and admin server:
          </p>

<div class="screen"><pre class="contents "><span class="cmd command">sudo systemctl start krb5-kdc.service</span>
<span class="cmd command">sudo systemctl start krb5-admin-server.service</span>
</pre></div>
        </li>
</ul></div>
<p class="para">
      You can now add Kerberos principals to the LDAP database, and they will be copied to any other LDAP servers configured for replication.
      To add a principal using the <span class="app application">kadmin.local</span> utility enter:
      </p>
<div class="screen"><pre class="contents "><span class="cmd command">sudo kadmin.local</span>
<span class="output computeroutput">Authenticating as principal root/admin@EXAMPLE.COM with password.
kadmin.local:  <span class="input userinput">addprinc -x dn="uid=steve,ou=people,dc=example,dc=com" steve</span>
WARNING: no policy specified for steve@EXAMPLE.COM; defaulting to no policy
Enter password for principal "steve@EXAMPLE.COM": 
Re-enter password for principal "steve@EXAMPLE.COM": 
Principal "steve@EXAMPLE.COM" created.</span>
</pre></div>
<p class="para">
      There should now be krbPrincipalName, krbPrincipalKey, krbLastPwdChange, and krbExtraData attributes added to the 
      <span class="em emphasis">uid=steve,ou=people,dc=example,dc=com</span> user object.  Use the <span class="app application">kinit</span> and 
      <span class="app application">klist</span> utilities to test that the user is indeed issued a ticket.
      </p>
<div class="note" title="Note"><div class="inner"><div class="region"><div class="contents">
        <p class="para">
        If the user object is already created the <span class="em emphasis">-x dn="..."</span> option is needed to add the Kerberos attributes.
        Otherwise a new <span class="em emphasis">principal</span> object will be created in the realm subtree.
        </p>
      </div></div></div></div>
</div></div>
</div></div>
<div class="sect2 sect" id="kerberos-ldap-secondary-kdc"><div class="inner">
<div class="hgroup"><h2 class="title">Secondary KDC Configuration</h2></div>
<div class="region"><div class="contents">
<p class="para">
      Configuring a Secondary KDC using the LDAP backend is similar to configuring one using the normal Kerberos database.
      </p>
<div class="steps"><div class="inner"><ol class="steps">
<li class="steps">
          <p class="para">
          First, install the necessary packages.  In a terminal enter:
          </p>

<div class="screen"><pre class="contents "><span class="cmd command">sudo apt install krb5-kdc krb5-admin-server krb5-kdc-ldap</span>
</pre></div>

        </li>
<li class="steps">

          <p class="para">
          Next, edit <span class="file filename">/etc/krb5.conf</span> to use the LDAP backend:
          </p>

<div class="code"><pre class="contents ">[libdefaults]
        default_realm = EXAMPLE.COM

...

[realms]
        EXAMPLE.COM = {
                kdc = kdc01.example.com
                kdc = kdc02.example.com
                admin_server = kdc01.example.com
                admin_server = kdc02.example.com
                default_domain = example.com
                database_module = openldap_ldapconf
        }

...

[domain_realm]
        .example.com = EXAMPLE.COM

...

[dbdefaults]
        ldap_kerberos_container_dn = dc=example,dc=com

[dbmodules]
        openldap_ldapconf = {
                db_library = kldap
                ldap_kdc_dn = "cn=admin,dc=example,dc=com"

                # this object needs to have read rights on
                # the realm container, principal container and realm sub-trees
                ldap_kadmind_dn = "cn=admin,dc=example,dc=com"

                # this object needs to have read and write rights on
                # the realm container, principal container and realm sub-trees
                ldap_service_password_file = /etc/krb5kdc/service.keyfile
                ldap_servers = ldaps://ldap01.example.com ldaps://ldap02.example.com
                ldap_conns_per_server = 5
        }
</pre></div>


        </li>
<li class="steps">
        
      <p class="para">
      Create the stash for the LDAP bind password:
      </p>

<div class="screen"><pre class="contents "><span class="cmd command">sudo kdb5_ldap_util -D  cn=admin,dc=example,dc=com stashsrvpw -f \
/etc/krb5kdc/service.keyfile cn=admin,dc=example,dc=com</span>
</pre></div>
      
        </li>
<li class="steps">

          <p class="para">
          Now, on the <span class="em emphasis">Primary KDC</span> copy the <span class="file filename">/etc/krb5kdc/.k5.EXAMPLE.COM</span> 
          <span class="em emphasis">Master Key</span> stash to the Secondary KDC.  Be sure to copy the file over an encrypted 
          connection such as <span class="app application">scp</span>, or on physical media.
          </p>

<div class="screen"><pre class="contents "><span class="cmd command">sudo scp /etc/krb5kdc/.k5.EXAMPLE.COM steve@kdc02.example.com:~</span>
<span class="cmd command">sudo mv .k5.EXAMPLE.COM /etc/krb5kdc/</span>
</pre></div>

        <div class="note" title="Note"><div class="inner"><div class="region"><div class="contents">
          <p class="para">
          Again, replace <span class="em emphasis">EXAMPLE.COM</span> with your actual realm.
          </p>
        </div></div></div></div>

        </li>
<li class="steps">

          <p class="para">
          Back on the <span class="em emphasis">Secondary KDC</span>, (re)start the ldap
	  server only,
          </p>

<div class="screen"><pre class="contents "><span class="cmd command">sudo systemctl restart slapd.service</span>
</pre></div>

        </li>
<li class="steps">

          <p class="para">
          Finally, start the <span class="app application">krb5-kdc</span> daemon:
          </p>

<div class="screen"><pre class="contents "><span class="cmd command">sudo systemctl start krb5-kdc.service</span>
</pre></div>

        </li>
<li class="steps">

          <p class="para">
          Verify the two ldap servers (and kerberos by extension) are in sync.
          </p>

        </li>
</ol></div></div>
<p class="para">
      You now have redundant KDCs on your network, and with redundant LDAP servers you should be able to 
      continue to authenticate users if one LDAP server, one Kerberos server, or one LDAP and one Kerberos 
      server become unavailable. 
      </p>
</div></div>
</div></div>
<div class="sect2 sect" id="kerberos-ldap-resources"><div class="inner">
<div class="hgroup"><h2 class="title">Resources</h2></div>
<div class="region"><div class="contents"><div class="list itemizedlist"><ul class="list itemizedlist">
<li class="list itemizedlist">
          <p class="para">
          The <a href="http://web.mit.edu/Kerberos/krb5-1.6/krb5-1.6.3/doc/krb5-admin.html#Configuring-Kerberos-with-OpenLDAP-back_002dend" class="ulink" title="http://web.mit.edu/Kerberos/krb5-1.6/krb5-1.6.3/doc/krb5-admin.html#Configuring-Kerberos-with-OpenLDAP-back_002dend">
          Kerberos Admin Guide</a> has some additional details.
          </p>
        </li>
<li class="list itemizedlist">
          <p class="para">
          For more information on <span class="app application">kdb5_ldap_util</span> see 
          <a href="http://web.mit.edu/Kerberos/krb5-1.6/krb5-1.6.3/doc/krb5-admin.html#Global-Operations-on-the-Kerberos-LDAP-Database" class="ulink" title="http://web.mit.edu/Kerberos/krb5-1.6/krb5-1.6.3/doc/krb5-admin.html#Global-Operations-on-the-Kerberos-LDAP-Database">
          Section 5.6</a> and the 
          <a href="http://manpages.ubuntu.com/manpages/bionic/en/man8/kdb5_ldap_util.8.html" class="ulink" title="http://manpages.ubuntu.com/manpages/bionic/en/man8/kdb5_ldap_util.8.html">kdb5_ldap_util man page</a>.
          </p>
        </li>
<li class="list itemizedlist">
          <p class="para">
          Another useful link is the <a href="http://manpages.ubuntu.com/manpages/bionic/en/man5/krb5.conf.5.html" class="ulink" title="http://manpages.ubuntu.com/manpages/bionic/en/man5/krb5.conf.5.html">krb5.conf man page</a>.
          </p>
        </li>
<li class="list itemizedlist">
          <p class="para">
          Also, see the <a href="https://help.ubuntu.com/community/Kerberos#kerberos-ldap" class="ulink" title="https://help.ubuntu.com/community/Kerberos#kerberos-ldap">Kerberos and LDAP</a> Ubuntu wiki page.
          </p>
        </li>
</ul></div></div></div>
</div></div>
</div>
<div class="links nextlinks">
<a class="nextlinks-prev" href="kerberos.html" title="Kerberos">Previous</a><a class="nextlinks-next" href="sssd-ad.html" title="SSSD and Active Directory">Next</a>
</div>
<div class="clear"></div>
</div>
<div id="pagebottom"></div>
</div></div>
</div>
<div id="footer"><p>The material in this document is available under a free license, see <a href="https://help.ubuntu.com/legal.html">Legal</a> for details.<br>
          For information on contributing see the <a href="https://wiki.ubuntu.com/DocumentationTeam">Ubuntu Documentation Team wiki page</a>.
          To report errors in this serverguide documentation, <a href="https://bugs.launchpad.net/serverguide">file a bug report</a>.</p></div>
</div>
</body>
</html>
